Vulnerabilities
Summary — last 7 days
New vulnerabilities2,806▲ 5 vs. last week
Critical / high1,465▲ 246 vs. last week
New active exploitation (KEV)5▼ 5 vs. last week
Unscored (no CVSS)77▼ 441 vs. last week
41 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.9) | 0.41% | — | Appleple A-blog CMSAI | 9/11/2026 | 9/16/2026 | a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product. | |
| Deferred | Medium (6.1) | 0.26% | — | Sourcecodester Fantastic Blog CMSAI | 7/29/2026 | 7/30/2026 | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. | |
| Analyzed | Low (2.1) | 0.40% | — | Appleple A-blog CMS | 5/19/2025 | 6/17/2026 | a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session. | |
| Analyzed | Critical (9.2) | 0.51% | — | Appleple A-blog CMS | 5/19/2025 | 6/17/2026 | Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request. | |
| Analyzed | Medium (4.8) | 0.25% | — | Appleple A-blog CMS | 5/19/2025 | 6/17/2026 | Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on… | |
| Analyzed | Medium (5.1) | 0.49% | — | Appleple A-blog CMS | 5/19/2025 | 6/17/2026 | Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with… | |
| Analyzed | High (7.5) | 0.48% | — | Appleple A-blog CMS | 3/31/2025 | 6/17/2026 | Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server. | |
| Analyzed | Medium (6.6) | 0.41% | — | Appleple A-blog CMS | 5/22/2024 | 6/17/2026 | Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on the server. | |
| Analyzed | Medium (6.1) | 0.30% | — | Appleple A-blog CMS | 5/22/2024 | 6/17/2026 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a… | |
| Analyzed | Medium (6.5) | 0.74% | — | Appleple A-blog CMS | 5/22/2024 | 6/17/2026 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a… | |
| Analyzed | Medium (4.4) | 0.32% | — | Appleple A-blog CMS | 5/22/2024 | 6/17/2026 | Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the… | |
| Analyzed | Medium (5.4) | 0.25% | — | Appleple A-blog CMS | 5/22/2024 | 6/17/2026 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a… | |
| Analyzed | Medium (6.5) | 0.83% | — | Appleple A-blog CMS | 3/12/2024 | 6/17/2026 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or… | |
| Analyzed | Medium (4.7) | 0.45% | — | Appleple A-blog CMS | 2/15/2024 | 6/17/2026 | URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log. | |
| Modified | Medium (5.4) | 0.30% | — | Appleple A-blog CMS | 1/28/2024 | 6/17/2026 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited,… | |
| Modified | High (8.8) | 0.69% | — | Appleple A-blog CMS | 1/23/2024 | 6/17/2026 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to… | |
| Modified | Medium (5.4) | 0.36% | — | Appleple A-blog CMS | 1/23/2024 | 6/17/2026 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute an… | |
| Modified | High (8.1) | 0.75% | — | Appleple A-blog CMS | 1/23/2024 | 6/17/2026 | Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to delete… | |
| Modified | Medium (6.1) | 0.41% | — | Appleple A-blog CMS | 1/23/2024 | 6/17/2026 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote unauthenticated attacker to execute… | |
| Modified | High (8.8) | 0.92% | — | Appleple A-blog CMS | 1/23/2024 | 6/17/2026 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to… | |
| Modified | Critical (9.8) | 1.1% | — | Moguit Mogu Blog CMS | 4/8/2022 | 6/17/2026 | mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation. | |
| Modified | Medium (6.1) | 0.91% | — | Appleple A-blog CMS | 2/24/2022 | 6/17/2026 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated… | |
| Modified | Medium (6.1) | 0.77% | — | Appleple A-blog CMS | 2/24/2022 | 6/17/2026 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated… | |
| Modified | Medium (6.5) | 1.1% | — | Appleple A-blog CMS | 2/24/2022 | 6/17/2026 | Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and… | |
| Modified | Critical (9.8) | 1.5% | — | Appleple A-blog CMS | 2/24/2022 | 6/17/2026 | Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated attacker to bypass authentication under… |